Is it possible in xml to create a color palette based on two separate fields. I would like a field to be a specific value to color another field while that field also being conditional.
In my case, I have a field called task_pct and one called labor_variance. I would like to only do a color scheme if task_pct is 1.00 for 100% complete and then red for anything above 0 and green for anything below 0 while also ignoring coloring if it is not 1.00.
You can set up two panels with identical labor_variance, then hide one or the other based on task_pct. Like this:
| Color | No color |
The following code borrows from How to set token from search and then conditionally show a panel.
<form version="1.1" theme="light">
<label>Color palette based on two values</label>
<description>https://community.splunk.com/t5/Dashboards-Visualizations/Color-Palette-Expression-based-on-two-fields/m-p/757387#M59355</description>
<fieldset submitButton="false">
<input type="radio" token="task_pct_tok" searchWhenChanged="true">
<label>task_pct</label>
<choice value="0">0</choice>
<choice value="0.5">0.5</choice>
<choice value="1">1.0</choice>
<default>1</default>
</input>
<input type="radio" token="labor_variance_tok" searchWhenChanged="true">
<label>labor_variance</label>
<choice value="-0.2">-0.2</choice>
<choice value="0">0</choice>
<choice value="0.5">0.5</choice>
<default>0.5</default>
</input>
</fieldset>
<row>
<panel depends="$useColors_tok$">
<title>task_pct is $task_pct_tok$</title>
<single>
<search>
<query>| makeresults format=csv data="labor_variance,task_pct
$labor_variance_tok$,$task_pct_tok$"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<done>
<condition>
<eval token="useColors_tok">if($result.task_pct$ == 1, "true", null())</eval>
</condition>
</done>
</search>
<option name="drilldown">none</option>
<option name="numberPrecision">0.0</option>
<option name="rangeColors">["0x53a051","0xdc4e41"]</option>
<option name="rangeValues">[0]</option>
<option name="useColors">1</option>
</single>
</panel>
<panel rejects="$useColors_tok$">
<title>task_pct_is $task_pct_tok$</title>
<single>
<search>
<query>| makeresults format=csv data="labor_variance,task_pct
$labor_variance_tok$,$task_pct_tok$"</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="numberPrecision">0.0</option>
<option name="refresh.display">progressbar</option>
</single>
</panel>
</row>
</form>The same idea can be used in Dashboard Studio.
In this example, the same search is performed in both panels. If your search is expensive, you can set it up in a base search and reference the base search in panels. In Simple XML, there is no clear documentation about how to do this; and it generally requires lots of diligence. In Dashboard Studio, base search is managed as a feature.